v2 rewrite in Rust

.github/workflows/build.yml

@@ -1,19 +1,57 @@
 name: Build
 
-on: [push]
+on: [push, pull_request]
+
+permissions:
+    contents: read
 
 jobs:
-    lint-node:
+    test:
+        name: Rust test & lint
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v3
-            - uses: actions/setup-node@v3
-              with:
-                  node-version: 12
-            - name: Cache module
-              uses: actions/cache@v3
+            - uses: actions/checkout@v6
+            - name: Install Rust toolchain
+              uses: dtolnay/rust-toolchain@stable
               with:
-                  path: ~/.npm/
-                  key: npm-cache
-            - name: Install modules
-              run: npm ci
+                  components: clippy, rustfmt
+            - name: Cache cargo artifacts
+              uses: Swatinem/rust-cache@v2
+            - name: Check formatting
+              run: cargo fmt --all -- --check
+            - name: Clippy
+              run: cargo clippy --all-targets --locked -- -D warnings
+            - name: Run tests
+              run: cargo test --locked --all-targets
+
+    docker:
+        name: Build Docker image
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v6
+            - uses: docker/setup-qemu-action@v3
+            - uses: docker/setup-buildx-action@v4
+            - name: Build action image
+              run: make docker-build
+              env:
+                  PLATFORM: linux/amd64
+                  ACTION: load
+                  PROGRESS_MODE: plain
+                  IMAGE_TAG: action-pull-request-lock:ci
+
+            # ---- Smoke tests on the freshly-built image ------------------
+            - name: Smoke test — image inspection
+              run: docker image inspect action-pull-request-lock:ci --format '{{.Os}}/{{.Architecture}} entrypoint={{.Config.Entrypoint}}'
+
+            - name: Smoke test — missing input fails with exit 1
+              run: |
+                  set +e
+                  docker run --rm action-pull-request-lock:ci >/tmp/out 2>&1
+                  code=$?
+                  set -e
+                  echo "=== exit: $code ==="
+                  echo "=== output: ==="
+                  cat /tmp/out
+                  echo "=== end ==="
+                  test "$code" -ne 0
+                  grep -q "Input required and not supplied: github-token" /tmp/out

.github/workflows/lock.yml

@@ -6,9 +6,12 @@ on:
 jobs:
     lock:
         runs-on: ubuntu-latest
+        permissions:
+            issues: write
+            pull-requests: write
         steps:
             - name: lock pull request
-              uses: sudo-bot/action-pull-request-lock@v1.1.0
+              uses: sudo-bot/action-pull-request-lock@v2
               with:
                   github-token: ${{ secrets.GITHUB_TOKEN }}
                   number: ${{ github.event.pull_request.number }}

.github/workflows/release.yml

@@ -0,0 +1,40 @@
+name: Build and publish the docker image
+
+# `contents: read` to check out the code, `packages: write` so GITHUB_TOKEN
+# can push to ghcr.io/<owner>/<repo> without any extra secrets.
+permissions:
+  contents: read
+  packages: write
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v2"
+
+jobs:
+    build-and-publish-action:
+        name: Build and publish the docker image
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v6
+            # https://github.com/docker/setup-qemu-action
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@v3
+            # https://github.com/docker/setup-buildx-action
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@v3
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+            - name: Build action image
+              run: make docker-build
+              env:
+                PLATFORM: linux/amd64
+                ACTION: push
+                PROGRESS_MODE: plain
+                IMAGE_TAG: ghcr.io/${{ github.repository }}

.gitignore

@@ -1,13 +1,2 @@
 /.env
-/node_modules/**/*.md
-!/node_modules/**/LICENSE.*
-/node_modules/**/.github
-/node_modules/**/.github
-/node_modules/**/.travis.yml
-/node_modules/**/.npm*
-/node_modules/**/*.map
-/node_modules/**/*.d.ts
-/node_modules/**/test
-/node_modules/@types
-/node_modules/@octokit/types
-/node_modules/pump/test-*
+/target